From 78cb19d8d75a0db9e52a7d15252e93753486331f Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sun, 6 Sep 2026 23:33:35 -0700
Subject: [PATCH] fix: validate registry credentials before docker login

Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.
---
 .gitea/workflows/ci.yaml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 21dee92..0f8efae 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -50,13 +50,21 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Validate registry credentials
+        run: |
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+            echo "❌ ERROR: Registry secrets not configured"
+            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
+            exit 1
+          fi
+          echo "✓ Registry credentials configured"
+
       - name: Registry login
         run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
+            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
         env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+          DOCKER_CONFIG: /tmp/docker-config
 
       - name: Build Docker image
         run: |